# KeyChain Added in[API level 14](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) Summary:[Constants](https://developer.android.com/reference/android/security/KeyChain#constants)\|[Ctors](https://developer.android.com/reference/android/security/KeyChain#pubctors)\|[Methods](https://developer.android.com/reference/android/security/KeyChain#pubmethods)\|[Inherited Methods](https://developer.android.com/reference/android/security/KeyChain#inhmethods) # KeyChain *** ** * ** *** [Kotlin](https://developer.android.com/reference/kotlin/android/security/KeyChain "View this page in Kotlin")\|Java ` public final class KeyChain ` ` extends `[Object](https://developer.android.com/reference/java/lang/Object)` `` ` |---|---------------------------| | [java.lang.Object](https://developer.android.com/reference/java/lang/Object) || | ↳ | android.security.KeyChain |
*** ** * ** *** The`KeyChain`class provides access to private keys and their corresponding certificate chains in credential storage. Applications accessing the`KeyChain`normally go through these steps: 1. Receive a callback from an[X509KeyManager](https://developer.android.com/reference/javax/net/ssl/X509KeyManager)that a private key is requested. 2. Call[choosePrivateKeyAlias](https://developer.android.com/reference/android/security/KeyChain#choosePrivateKeyAlias(android.app.Activity,%20android.security.KeyChainAliasCallback,%20java.lang.String[],%20java.security.Principal[],%20android.net.Uri,%20java.lang.String))to allow the user to select from a list of currently available private keys and corresponding certificate chains. The chosen alias will be returned by the callback[KeyChainAliasCallback.alias](https://developer.android.com/reference/android/security/KeyChainAliasCallback#alias(java.lang.String)), or null if no private key is available or the user cancels the request. 3. Call[getPrivateKey(Context, String)](https://developer.android.com/reference/android/security/KeyChain#getPrivateKey(android.content.Context,%20java.lang.String))and[getCertificateChain(Context, String)](https://developer.android.com/reference/android/security/KeyChain#getCertificateChain(android.content.Context,%20java.lang.String))to retrieve the credentials to return to the corresponding[X509KeyManager](https://developer.android.com/reference/javax/net/ssl/X509KeyManager)callbacks. An application may remember the value of a selected alias to avoid prompting the user with[choosePrivateKeyAlias](https://developer.android.com/reference/android/security/KeyChain#choosePrivateKeyAlias(android.app.Activity,%20android.security.KeyChainAliasCallback,%20java.lang.String[],%20java.security.Principal[],%20android.net.Uri,%20java.lang.String))on subsequent connections. If the alias is no longer valid, null will be returned on lookups using that value An application can request the installation of private keys and certificates via the`Intent`provided by[createInstallIntent()](https://developer.android.com/reference/android/security/KeyChain#createInstallIntent()). Private keys installed via this`Intent`will be accessible via[choosePrivateKeyAlias(Activity, KeyChainAliasCallback, String, Principal, Uri, String)](https://developer.android.com/reference/android/security/KeyChain#choosePrivateKeyAlias(android.app.Activity,%20android.security.KeyChainAliasCallback,%20java.lang.String[],%20java.security.Principal[],%20android.net.Uri,%20java.lang.String))while Certificate Authority (CA) certificates will be trusted by all applications through the default`X509TrustManager`. ## Summary | ### Constants || |--------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [String](https://developer.android.com/reference/java/lang/String) | [ACTION_KEYCHAIN_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_KEYCHAIN_CHANGED) Broadcast Action: Indicates the contents of the keychain has changed. | | [String](https://developer.android.com/reference/java/lang/String) | [ACTION_KEY_ACCESS_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_KEY_ACCESS_CHANGED) Broadcast Action: Indicates that the access permissions for a private key have changed. | | [String](https://developer.android.com/reference/java/lang/String) | [ACTION_STORAGE_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_STORAGE_CHANGED) *This constant was deprecated in API level 26. Use[ACTION_KEYCHAIN_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_KEYCHAIN_CHANGED),[ACTION_TRUST_STORE_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_TRUST_STORE_CHANGED)or[ACTION_KEY_ACCESS_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_KEY_ACCESS_CHANGED). Apps that target a version higher than[Build.VERSION_CODES.N_MR1](https://developer.android.com/reference/android/os/Build.VERSION_CODES#N_MR1)will only receive this broadcast if they register for it at runtime.* | | [String](https://developer.android.com/reference/java/lang/String) | [ACTION_TRUST_STORE_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_TRUST_STORE_CHANGED) Broadcast Action: Indicates the contents of the trusted certificate store has changed. | | [String](https://developer.android.com/reference/java/lang/String) | [EXTRA_CERTIFICATE](https://developer.android.com/reference/android/security/KeyChain#EXTRA_CERTIFICATE) Optional extra to specify an X.509 certificate to install on the`Intent`returned by[createInstallIntent()](https://developer.android.com/reference/android/security/KeyChain#createInstallIntent()). | | [String](https://developer.android.com/reference/java/lang/String) | [EXTRA_KEY_ACCESSIBLE](https://developer.android.com/reference/android/security/KeyChain#EXTRA_KEY_ACCESSIBLE) Used as a boolean extra field in[ACTION_KEY_ACCESS_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_KEY_ACCESS_CHANGED)to supply if the key is accessible to the application. | | [String](https://developer.android.com/reference/java/lang/String) | [EXTRA_KEY_ALIAS](https://developer.android.com/reference/android/security/KeyChain#EXTRA_KEY_ALIAS) Used as a String extra field in[ACTION_KEY_ACCESS_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_KEY_ACCESS_CHANGED)to supply the alias of the key. | | [String](https://developer.android.com/reference/java/lang/String) | [EXTRA_NAME](https://developer.android.com/reference/android/security/KeyChain#EXTRA_NAME) Optional extra to specify a`String`credential name on the`Intent`returned by[createInstallIntent()](https://developer.android.com/reference/android/security/KeyChain#createInstallIntent()). | | [String](https://developer.android.com/reference/java/lang/String) | [EXTRA_PKCS12](https://developer.android.com/reference/android/security/KeyChain#EXTRA_PKCS12) Optional extra for use with the`Intent`returned by[createInstallIntent()](https://developer.android.com/reference/android/security/KeyChain#createInstallIntent())to specify a PKCS#12 key store to install. | | [String](https://developer.android.com/reference/java/lang/String) | [KEY_ALIAS_SELECTION_DENIED](https://developer.android.com/reference/android/security/KeyChain#KEY_ALIAS_SELECTION_DENIED) Used by DPC or delegated app in[DeviceAdminReceiver.onChoosePrivateKeyAlias(Context, Intent, int, Uri, String)](https://developer.android.com/reference/android/app/admin/DeviceAdminReceiver#onChoosePrivateKeyAlias(android.content.Context,%20android.content.Intent,%20int,%20android.net.Uri,%20java.lang.String))or[DelegatedAdminReceiver.onChoosePrivateKeyAlias(Context, Intent, int, Uri, String)](https://developer.android.com/reference/android/app/admin/DelegatedAdminReceiver#onChoosePrivateKeyAlias(android.content.Context,%20android.content.Intent,%20int,%20android.net.Uri,%20java.lang.String))to identify that the requesting app is not granted access to any key, and nor will the user be able to grant access manually. | | ### Public constructors || |--------------------------------------------------------------------------------------------------|---| | ` `[KeyChain](https://developer.android.com/reference/android/security/KeyChain#KeyChain())`() ` | | ### Public methods || |-----------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ` static void` | ` `[choosePrivateKeyAlias](https://developer.android.com/reference/android/security/KeyChain#choosePrivateKeyAlias(android.app.Activity,%20android.security.KeyChainAliasCallback,%20java.lang.String[],%20java.security.Principal[],%20java.lang.String,%20int,%20java.lang.String))`(`[Activity](https://developer.android.com/reference/android/app/Activity)` activity, `[KeyChainAliasCallback](https://developer.android.com/reference/android/security/KeyChainAliasCallback)` response, `[String[]](https://developer.android.com/reference/java/lang/String)` keyTypes, `[Principal[]](https://developer.android.com/reference/java/security/Principal)` issuers, `[String](https://developer.android.com/reference/java/lang/String)` host, int port, `[String](https://developer.android.com/reference/java/lang/String)` alias) ` Launches an`Activity`for the user to select the alias for a private key and certificate pair for authentication. | | ` static void` | ` `[choosePrivateKeyAlias](https://developer.android.com/reference/android/security/KeyChain#choosePrivateKeyAlias(android.app.Activity,%20android.security.KeyChainAliasCallback,%20java.lang.String[],%20java.security.Principal[],%20android.net.Uri,%20java.lang.String))`(`[Activity](https://developer.android.com/reference/android/app/Activity)` activity, `[KeyChainAliasCallback](https://developer.android.com/reference/android/security/KeyChainAliasCallback)` response, `[String[]](https://developer.android.com/reference/java/lang/String)` keyTypes, `[Principal[]](https://developer.android.com/reference/java/security/Principal)` issuers, `[Uri](https://developer.android.com/reference/android/net/Uri)` uri, `[String](https://developer.android.com/reference/java/lang/String)` alias) ` Launches an`Activity`for the user to select the alias for a private key and certificate pair for authentication. | | ` static `[Intent](https://developer.android.com/reference/android/content/Intent) | ` `[createInstallIntent](https://developer.android.com/reference/android/security/KeyChain#createInstallIntent())`() ` Returns an`Intent`that can be used for credential installation. | | ` static `[Intent](https://developer.android.com/reference/android/content/Intent) | ` `[createManageCredentialsIntent](https://developer.android.com/reference/android/security/KeyChain#createManageCredentialsIntent(android.security.AppUriAuthenticationPolicy))`(`[AppUriAuthenticationPolicy](https://developer.android.com/reference/android/security/AppUriAuthenticationPolicy)` policy) ` Returns an`Intent`that should be used by an app to request to manage the user's credentials. | | ` static `[X509Certificate[]](https://developer.android.com/reference/java/security/cert/X509Certificate) | ` `[getCertificateChain](https://developer.android.com/reference/android/security/KeyChain#getCertificateChain(android.content.Context,%20java.lang.String))`(`[Context](https://developer.android.com/reference/android/content/Context)` context, `[String](https://developer.android.com/reference/java/lang/String)` alias) ` Returns the`X509Certificate`chain for the requested alias, or null if the alias does not exist or the caller has no permission to access it (see note on exceptions in[getPrivateKey(Context, String)](https://developer.android.com/reference/android/security/KeyChain#getPrivateKey(android.content.Context,%20java.lang.String))). | | ` static `[AppUriAuthenticationPolicy](https://developer.android.com/reference/android/security/AppUriAuthenticationPolicy) | ` `[getCredentialManagementAppPolicy](https://developer.android.com/reference/android/security/KeyChain#getCredentialManagementAppPolicy(android.content.Context))`(`[Context](https://developer.android.com/reference/android/content/Context)` context) ` Called by the credential management app to get the authentication policy[AppUriAuthenticationPolicy](https://developer.android.com/reference/android/security/AppUriAuthenticationPolicy). | | ` static `[PrivateKey](https://developer.android.com/reference/java/security/PrivateKey) | ` `[getPrivateKey](https://developer.android.com/reference/android/security/KeyChain#getPrivateKey(android.content.Context,%20java.lang.String))`(`[Context](https://developer.android.com/reference/android/content/Context)` context, `[String](https://developer.android.com/reference/java/lang/String)` alias) ` Returns the`PrivateKey`for the requested alias, or null if the alias does not exist or the caller has no permission to access it (see note on exceptions below). | | ` static boolean` | ` `[isBoundKeyAlgorithm](https://developer.android.com/reference/android/security/KeyChain#isBoundKeyAlgorithm(java.lang.String))`(`[String](https://developer.android.com/reference/java/lang/String)` algorithm) ` *This method was deprecated in API level 23. Whether the key is bound to the secure hardware is known only once the key has been imported. To find out, use:* ``` `PrivateKey key = ...; // private key from KeyChain KeyFactory keyFactory = KeyFactory.getInstance(key.getAlgorithm(), "AndroidKeyStore"); KeyInfo keyInfo = keyFactory.getKeySpec(key, KeyInfo.class); if (keyInfo.isInsideSecureHardware()) { // The key is bound to the secure hardware of this Android }` ```
| | ` static boolean` | ` `[isCredentialManagementApp](https://developer.android.com/reference/android/security/KeyChain#isCredentialManagementApp(android.content.Context))`(`[Context](https://developer.android.com/reference/android/content/Context)` context) ` Check whether the caller is the credential management app`CredentialManagementApp`. | | ` static boolean` | ` `[isKeyAlgorithmSupported](https://developer.android.com/reference/android/security/KeyChain#isKeyAlgorithmSupported(java.lang.String))`(`[String](https://developer.android.com/reference/java/lang/String)` algorithm) ` Returns`true`if the current device's`KeyChain`supports a specific`PrivateKey`type indicated by`algorithm`(e.g., "RSA"). | | ` static boolean` | ` `[removeCredentialManagementApp](https://developer.android.com/reference/android/security/KeyChain#removeCredentialManagementApp(android.content.Context))`(`[Context](https://developer.android.com/reference/android/content/Context)` context) ` Called by the credential management app`CredentialManagementApp`to unregister as the credential management app and stop managing the user's credentials. | | ### Inherited methods | |-----------------------|---| | From class` `[java.lang.Object](https://developer.android.com/reference/java/lang/Object)` ` |--------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ` `[Object](https://developer.android.com/reference/java/lang/Object) | ` `[clone](https://developer.android.com/reference/java/lang/Object#clone())`() ` Creates and returns a copy of this object. | | ` boolean` | ` `[equals](https://developer.android.com/reference/java/lang/Object#equals(java.lang.Object))`(`[Object](https://developer.android.com/reference/java/lang/Object)` obj) ` Indicates whether some other object is "equal to" this one. | | ` void` | ` `[finalize](https://developer.android.com/reference/java/lang/Object#finalize())`() ` Called by the garbage collector on an object when garbage collection determines that there are no more references to the object. | | ` final `[Class](https://developer.android.com/reference/java/lang/Class)`` | ` `[getClass](https://developer.android.com/reference/java/lang/Object#getClass())`() ` Returns the runtime class of this`Object`. | | ` int` | ` `[hashCode](https://developer.android.com/reference/java/lang/Object#hashCode())`() ` Returns a hash code value for the object. | | ` final void` | ` `[notify](https://developer.android.com/reference/java/lang/Object#notify())`() ` Wakes up a single thread that is waiting on this object's monitor. | | ` final void` | ` `[notifyAll](https://developer.android.com/reference/java/lang/Object#notifyAll())`() ` Wakes up all threads that are waiting on this object's monitor. | | ` `[String](https://developer.android.com/reference/java/lang/String) | ` `[toString](https://developer.android.com/reference/java/lang/Object#toString())`() ` Returns a string representation of the object. | | ` final void` | ` `[wait](https://developer.android.com/reference/java/lang/Object#wait(long,%20int))`(long timeoutMillis, int nanos) ` Causes the current thread to wait until it is awakened, typically by being*notified* or*interrupted*, or until a certain amount of real time has elapsed. | | ` final void` | ` `[wait](https://developer.android.com/reference/java/lang/Object#wait(long))`(long timeoutMillis) ` Causes the current thread to wait until it is awakened, typically by being*notified* or*interrupted*, or until a certain amount of real time has elapsed. | | ` final void` | ` `[wait](https://developer.android.com/reference/java/lang/Object#wait())`() ` Causes the current thread to wait until it is awakened, typically by being*notified* or*interrupted*. | || ## Constants ### ACTION_KEYCHAIN_CHANGED Added in[API level 26](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final String ACTION_KEYCHAIN_CHANGED ``` Broadcast Action: Indicates the contents of the keychain has changed. Sent when a KeyChain entry is added, modified or removed.
Constant Value: "android.security.action.KEYCHAIN_CHANGED" ### ACTION_KEY_ACCESS_CHANGED Added in[API level 26](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final String ACTION_KEY_ACCESS_CHANGED ``` Broadcast Action: Indicates that the access permissions for a private key have changed.
Constant Value: "android.security.action.KEY_ACCESS_CHANGED" ### ACTION_STORAGE_CHANGED Added in[API level 16](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) Deprecated in[API level 26](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final String ACTION_STORAGE_CHANGED ```
**This constant was deprecated in API level 26.** Use[ACTION_KEYCHAIN_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_KEYCHAIN_CHANGED),[ACTION_TRUST_STORE_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_TRUST_STORE_CHANGED)or[ACTION_KEY_ACCESS_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_KEY_ACCESS_CHANGED). Apps that target a version higher than[Build.VERSION_CODES.N_MR1](https://developer.android.com/reference/android/os/Build.VERSION_CODES#N_MR1)will only receive this broadcast if they register for it at runtime. Broadcast Action: Indicates the trusted storage has changed. Sent when one of this happens: - a new CA is added, - an existing CA is removed or disabled, - a disabled CA is enabled, - trusted storage is reset (all user certs are cleared), - when permission to access a private key is changed.

Constant Value: "android.security.STORAGE_CHANGED" ### ACTION_TRUST_STORE_CHANGED Added in[API level 26](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final String ACTION_TRUST_STORE_CHANGED ``` Broadcast Action: Indicates the contents of the trusted certificate store has changed. Sent when one the following occurs: - A pre-installed CA is disabled or re-enabled - A CA is added or removed from the trust store

Constant Value: "android.security.action.TRUST_STORE_CHANGED" ### EXTRA_CERTIFICATE Added in[API level 14](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final String EXTRA_CERTIFICATE ``` Optional extra to specify an X.509 certificate to install on the`Intent`returned by[createInstallIntent()](https://developer.android.com/reference/android/security/KeyChain#createInstallIntent()). The extra value should be a PEM or ASN.1 DER encoded`byte[]`. An[X509Certificate](https://developer.android.com/reference/java/security/cert/X509Certificate)can be converted to DER encoded bytes with[X509Certificate.getEncoded](https://developer.android.com/reference/java/security/cert/Certificate#getEncoded()). [EXTRA_NAME](https://developer.android.com/reference/android/security/KeyChain#EXTRA_NAME)may be used to provide a default alias name for the installed certificate.
Constant Value: "CERT" ### EXTRA_KEY_ACCESSIBLE Added in[API level 26](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final String EXTRA_KEY_ACCESSIBLE ``` Used as a boolean extra field in[ACTION_KEY_ACCESS_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_KEY_ACCESS_CHANGED)to supply if the key is accessible to the application.
Constant Value: "android.security.extra.KEY_ACCESSIBLE" ### EXTRA_KEY_ALIAS Added in[API level 26](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final String EXTRA_KEY_ALIAS ``` Used as a String extra field in[ACTION_KEY_ACCESS_CHANGED](https://developer.android.com/reference/android/security/KeyChain#ACTION_KEY_ACCESS_CHANGED)to supply the alias of the key.
Constant Value: "android.security.extra.KEY_ALIAS" ### EXTRA_NAME Added in[API level 14](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final String EXTRA_NAME ``` Optional extra to specify a`String`credential name on the`Intent`returned by[createInstallIntent()](https://developer.android.com/reference/android/security/KeyChain#createInstallIntent()).
Constant Value: "name" ### EXTRA_PKCS12 Added in[API level 14](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final String EXTRA_PKCS12 ``` Optional extra for use with the`Intent`returned by[createInstallIntent()](https://developer.android.com/reference/android/security/KeyChain#createInstallIntent())to specify a PKCS#12 key store to install. The extra value should be a`byte[]`. The bytes may come from an external source or be generated with[KeyStore.store(OutputStream, char)](https://developer.android.com/reference/java/security/KeyStore#store(java.io.OutputStream,%20char[]))on a "PKCS12" instance. The user will be prompted for the password to load the key store. The key store will be scanned for[KeyStore.PrivateKeyEntry](https://developer.android.com/reference/java/security/KeyStore.PrivateKeyEntry)entries and both the private key and associated certificate chain will be installed. [EXTRA_NAME](https://developer.android.com/reference/android/security/KeyChain#EXTRA_NAME)may be used to provide a default alias name for the installed credentials.
Constant Value: "PKCS12" ### KEY_ALIAS_SELECTION_DENIED Added in[API level 30](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static final String KEY_ALIAS_SELECTION_DENIED ``` Used by DPC or delegated app in[DeviceAdminReceiver.onChoosePrivateKeyAlias(Context, Intent, int, Uri, String)](https://developer.android.com/reference/android/app/admin/DeviceAdminReceiver#onChoosePrivateKeyAlias(android.content.Context,%20android.content.Intent,%20int,%20android.net.Uri,%20java.lang.String))or[DelegatedAdminReceiver.onChoosePrivateKeyAlias(Context, Intent, int, Uri, String)](https://developer.android.com/reference/android/app/admin/DelegatedAdminReceiver#onChoosePrivateKeyAlias(android.content.Context,%20android.content.Intent,%20int,%20android.net.Uri,%20java.lang.String))to identify that the requesting app is not granted access to any key, and nor will the user be able to grant access manually.
Constant Value: "android:alias-selection-denied" ## Public constructors ### KeyChain ``` public KeyChain () ```

## Public methods ### choosePrivateKeyAlias Added in[API level 14](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static void choosePrivateKeyAlias (Activity activity, KeyChainAliasCallback response, String[] keyTypes, Principal[] issuers, String host, int port, String alias) ``` Launches an`Activity`for the user to select the alias for a private key and certificate pair for authentication. The selected alias or null will be returned via the KeyChainAliasCallback callback. A device policy controller (as a device or profile owner) can intercept the request before the activity is shown, to pick a specific private key alias by implementing[onChoosePrivateKeyAlias](https://developer.android.com/reference/android/app/admin/DeviceAdminReceiver#onChoosePrivateKeyAlias(android.content.Context,%20android.content.Intent,%20int,%20android.net.Uri,%20java.lang.String)). `keyTypes`and`issuers`may be used to narrow down suggested choices to the user. If either`keyTypes`or`issuers`is specified and non-empty, and there are no matching certificates in the KeyChain, then the certificate selection prompt would be suppressed entirely. `host`and`port`may be used to give the user more context about the server requesting the credentials. `alias`allows the caller to preselect an existing alias which will still be subject to user confirmation.
| Parameters || |------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `activity` | `Activity`: The[Activity](https://developer.android.com/reference/android/app/Activity)context to use for launching the new sub-Activity to prompt the user to select a private key; used only to call startActivity(); must not be null.
| | `response` | `KeyChainAliasCallback`: Callback to invoke when the request completes; must not be null.
| | `keyTypes` | `String`: The acceptable types of asymmetric keys such as "RSA", "EC" or null. Value is[KeyProperties.KEY_ALGORITHM_RSA](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_RSA),[KeyProperties.KEY_ALGORITHM_EC](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_EC), android.security.keystore.KeyProperties.KEY_ALGORITHM_XDH,[KeyProperties.KEY_ALGORITHM_AES](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_AES),[KeyProperties.KEY_ALGORITHM_HMAC_SHA1](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA1),[KeyProperties.KEY_ALGORITHM_HMAC_SHA224](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA224),[KeyProperties.KEY_ALGORITHM_HMAC_SHA256](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA256),[KeyProperties.KEY_ALGORITHM_HMAC_SHA384](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA384), or[KeyProperties.KEY_ALGORITHM_HMAC_SHA512](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA512)
| | `issuers` | `Principal`: The acceptable certificate issuers for the certificate matching the private key, or null.
| | `host` | `String`: The host name of the server requesting the certificate, or null if unavailable.
| | `port` | `int`: The port number of the server requesting the certificate, or -1 if unavailable.
| | `alias` | `String`: The alias to preselect if available, or null if unavailable.
| ### choosePrivateKeyAlias Added in[API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static void choosePrivateKeyAlias (Activity activity, KeyChainAliasCallback response, String[] keyTypes, Principal[] issuers, Uri uri, String alias) ``` Launches an`Activity`for the user to select the alias for a private key and certificate pair for authentication. The selected alias or null will be returned via the KeyChainAliasCallback callback. A device policy controller (as a device or profile owner) can intercept the request before the activity is shown, to pick a specific private key alias by implementing[onChoosePrivateKeyAlias](https://developer.android.com/reference/android/app/admin/DeviceAdminReceiver#onChoosePrivateKeyAlias(android.content.Context,%20android.content.Intent,%20int,%20android.net.Uri,%20java.lang.String)). `keyTypes`and`issuers`may be used to narrow down suggested choices to the user. If either`keyTypes`or`issuers`is specified and non-empty, and there are no matching certificates in the KeyChain, then the certificate selection prompt would be suppressed entirely. `uri`may be used to give the user more context about the server requesting the credentials. `alias`allows the caller to preselect an existing alias which will still be subject to user confirmation.
| Parameters || |------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `activity` | `Activity`: The[Activity](https://developer.android.com/reference/android/app/Activity)context to use for launching the new sub-Activity to prompt the user to select a private key; used only to call startActivity(); must not be null.
| | `response` | `KeyChainAliasCallback`: Callback to invoke when the request completes; must not be null.
| | `keyTypes` | `String`: The acceptable types of asymmetric keys such as "RSA", "EC" or null. Value is[KeyProperties.KEY_ALGORITHM_RSA](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_RSA),[KeyProperties.KEY_ALGORITHM_EC](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_EC), android.security.keystore.KeyProperties.KEY_ALGORITHM_XDH,[KeyProperties.KEY_ALGORITHM_AES](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_AES),[KeyProperties.KEY_ALGORITHM_HMAC_SHA1](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA1),[KeyProperties.KEY_ALGORITHM_HMAC_SHA224](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA224),[KeyProperties.KEY_ALGORITHM_HMAC_SHA256](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA256),[KeyProperties.KEY_ALGORITHM_HMAC_SHA384](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA384), or[KeyProperties.KEY_ALGORITHM_HMAC_SHA512](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA512)
| | `issuers` | `Principal`: The acceptable certificate issuers for the certificate matching the private key, or null.
| | `uri` | `Uri`: The full URI the server is requesting the certificate for, or null if unavailable.
| | `alias` | `String`: The alias to preselect if available, or null if unavailable.
| | Throws || |--------------------------------------------------------------------------------------------------------|----------------------------------------------------------| | [IllegalArgumentException](https://developer.android.com/reference/java/lang/IllegalArgumentException) | if the specified issuers are not of type`X500Principal`. | ### createInstallIntent Added in[API level 14](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static Intent createInstallIntent () ``` Returns an`Intent`that can be used for credential installation. The intent may be used without any extras, in which case the user will be able to install credentials from their own source. Alternatively,[EXTRA_CERTIFICATE](https://developer.android.com/reference/android/security/KeyChain#EXTRA_CERTIFICATE)or[EXTRA_PKCS12](https://developer.android.com/reference/android/security/KeyChain#EXTRA_PKCS12)maybe used to specify the bytes of an X.509 certificate or a PKCS#12 key store for installation. These extras may be combined with[EXTRA_NAME](https://developer.android.com/reference/android/security/KeyChain#EXTRA_NAME)to provide a default alias name for credentials being installed. When used with[Activity.startActivityForResult](https://developer.android.com/reference/android/app/Activity#startActivityForResult(android.content.Intent,%20int)),[Activity.RESULT_OK](https://developer.android.com/reference/android/app/Activity#RESULT_OK)will be returned if a credential was successfully installed, otherwise[Activity.RESULT_CANCELED](https://developer.android.com/reference/android/app/Activity#RESULT_CANCELED)will be returned. Starting from[Build.VERSION_CODES.R](https://developer.android.com/reference/android/os/Build.VERSION_CODES#R), the intent returned by this method cannot be used for installing CA certificates. Since CA certificates can only be installed via Settings, the app should provide the user with a file containing the CA certificate. One way to do this would be to use the[MediaStore](https://developer.android.com/reference/android/provider/MediaStore)API to write the certificate to the[MediaStore.Downloads](https://developer.android.com/reference/android/provider/MediaStore.Downloads)collection.
| Returns || |--------------------------------------------------------------------------|------------------------------------| | [Intent](https://developer.android.com/reference/android/content/Intent) | This value cannot be`null`.
| ### createManageCredentialsIntent Added in[API level 31](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static Intent createManageCredentialsIntent (AppUriAuthenticationPolicy policy) ``` Returns an`Intent`that should be used by an app to request to manage the user's credentials. This is limited to unmanaged devices. The authentication policy must be provided to be able to make this request successfully. This intent should be started using[Activity.startActivityForResult(Intent, int)](https://developer.android.com/reference/android/app/Activity#startActivityForResult(android.content.Intent,%20int))to verify whether the request was successful and whether the user accepted or denied the request. If the user successfully receives and accepts the request, the result code will be[Activity.RESULT_OK](https://developer.android.com/reference/android/app/Activity#RESULT_OK), otherwise the result code will be[Activity.RESULT_CANCELED](https://developer.android.com/reference/android/app/Activity#RESULT_CANCELED). [KeyChain.isCredentialManagementApp(Context)](https://developer.android.com/reference/android/security/KeyChain#isCredentialManagementApp(android.content.Context))should be used to determine whether an app is already the credential management app.
| Parameters || |----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `policy` | `AppUriAuthenticationPolicy`: The authentication policy determines which alias for a private key and certificate pair should be used for authentication. This value cannot be`null`.
| | Returns || |--------------------------------------------------------------------------|------------------------------------| | [Intent](https://developer.android.com/reference/android/content/Intent) | This value cannot be`null`.
| ### getCertificateChain Added in[API level 14](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static X509Certificate[] getCertificateChain (Context context, String alias) ``` Returns the`X509Certificate`chain for the requested alias, or null if the alias does not exist or the caller has no permission to access it (see note on exceptions in[getPrivateKey(Context, String)](https://developer.android.com/reference/android/security/KeyChain#getPrivateKey(android.content.Context,%20java.lang.String))). **Note:**If a certificate chain was explicitly specified when the alias was installed, this method will return that chain. If only the client certificate was specified at the installation time, this method will try to build a certificate chain using all available trust anchors (preinstalled and user-added). This method may block while waiting for a connection to another process, and must never be called from the main thread. As[Activity](https://developer.android.com/reference/android/app/Activity)and[Service](https://developer.android.com/reference/android/app/Service)contexts are short-lived and can be destroyed at any time from the main thread, it is safer to rely on a long-lived context such as one returned from[Context.getApplicationContext()](https://developer.android.com/reference/android/content/Context#getApplicationContext()). In case the caller specifies an alias for which it lacks a grant, it must call[choosePrivateKeyAlias(Activity, KeyChainAliasCallback, String, Principal, Uri, String)](https://developer.android.com/reference/android/security/KeyChain#choosePrivateKeyAlias(android.app.Activity,%20android.security.KeyChainAliasCallback,%20java.lang.String[],%20java.security.Principal[],%20android.net.Uri,%20java.lang.String))again. See[getPrivateKey(Context, String)](https://developer.android.com/reference/android/security/KeyChain#getPrivateKey(android.content.Context,%20java.lang.String))for more details on coping with this scenario. This method may take several seconds to complete, so it should only be called from a worker thread.
| Parameters || |-----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `context` | `Context`: This value cannot be`null`.
| | `alias` | `String`: The alias of the desired certificate chain, typically returned via[KeyChainAliasCallback.alias](https://developer.android.com/reference/android/security/KeyChainAliasCallback#alias(java.lang.String)). This value cannot be`null`.
| | Returns || |-------------------------------------------------------------------------------------------------|--------| | [X509Certificate[]](https://developer.android.com/reference/java/security/cert/X509Certificate) |
| | Throws || |--------------------------------------------------------------------------------------------------|-----------------------------------------------------------------| | [KeyChainException](https://developer.android.com/reference/android/security/KeyChainException) | if the alias was valid but there was some problem accessing it. | | [IllegalStateException](https://developer.android.com/reference/java/lang/IllegalStateException) | if called from the main thread. | | [InterruptedException](https://developer.android.com/reference/java/lang/InterruptedException) | | ### getCredentialManagementAppPolicy Added in[API level 31](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static AppUriAuthenticationPolicy getCredentialManagementAppPolicy (Context context) ``` Called by the credential management app to get the authentication policy[AppUriAuthenticationPolicy](https://developer.android.com/reference/android/security/AppUriAuthenticationPolicy). This method may take several seconds to complete, so it should only be called from a worker thread.
| Parameters || |-----------|-----------------------------------------------| | `context` | `Context`: This value cannot be`null`.
| | Returns || |-------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------| | [AppUriAuthenticationPolicy](https://developer.android.com/reference/android/security/AppUriAuthenticationPolicy) | the credential management app's authentication policy. This value cannot be`null`.
| | Throws || |------------------------------------------------------------------------------------------|-----------------------------------------------------| | [SecurityException](https://developer.android.com/reference/java/lang/SecurityException) | if the caller is not the credential management app. | ### getPrivateKey Added in[API level 14](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static PrivateKey getPrivateKey (Context context, String alias) ``` Returns the`PrivateKey`for the requested alias, or null if the alias does not exist or the caller has no permission to access it (see note on exceptions below). This method may block while waiting for a connection to another process, and must never be called from the main thread. As[Activity](https://developer.android.com/reference/android/app/Activity)and[Service](https://developer.android.com/reference/android/app/Service)contexts are short-lived and can be destroyed at any time from the main thread, it is safer to rely on a long-lived context such as one returned from[Context.getApplicationContext()](https://developer.android.com/reference/android/content/Context#getApplicationContext()). If the caller provides a valid alias to which it was not granted access, then the caller must invoke[choosePrivateKeyAlias(Activity, KeyChainAliasCallback, String, Principal, Uri, String)](https://developer.android.com/reference/android/security/KeyChain#choosePrivateKeyAlias(android.app.Activity,%20android.security.KeyChainAliasCallback,%20java.lang.String[],%20java.security.Principal[],%20android.net.Uri,%20java.lang.String))again to get another valid alias or a grant to access the same alias. On Android versions prior to Q, when a key associated with the specified alias is unavailable, the method will throw a`KeyChainException`rather than return null. If the exception's cause (as obtained by calling`KeyChainException.getCause()`) is a throwable of type`IllegalStateException`then the caller lacks a grant to access the key and certificates associated with this alias. This method may take several seconds to complete, so it should only be called from a worker thread.
| Parameters || |-----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `context` | `Context`: This value cannot be`null`.
| | `alias` | `String`: The alias of the desired private key, typically returned via[KeyChainAliasCallback.alias](https://developer.android.com/reference/android/security/KeyChainAliasCallback#alias(java.lang.String)). This value cannot be`null`.
| | Returns || |--------------------------------------------------------------------------------|--------| | [PrivateKey](https://developer.android.com/reference/java/security/PrivateKey) |
| | Throws || |--------------------------------------------------------------------------------------------------|-----------------------------------------------------------------| | [KeyChainException](https://developer.android.com/reference/android/security/KeyChainException) | if the alias was valid but there was some problem accessing it. | | [IllegalStateException](https://developer.android.com/reference/java/lang/IllegalStateException) | if called from the main thread. | | [InterruptedException](https://developer.android.com/reference/java/lang/InterruptedException) | | ### isBoundKeyAlgorithm Added in[API level 18](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) Deprecated in[API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static boolean isBoundKeyAlgorithm (String algorithm) ```
**This method was deprecated in API level 23.** Whether the key is bound to the secure hardware is known only once the key has been imported. To find out, use: PrivateKey key = ...; // private key from KeyChain KeyFactory keyFactory = KeyFactory.getInstance(key.getAlgorithm(), "AndroidKeyStore"); KeyInfo keyInfo = keyFactory.getKeySpec(key, KeyInfo.class); if (keyInfo.isInsideSecureHardware()) { // The key is bound to the secure hardware of this Android }
Returns`true`if the current device's`KeyChain`binds any`PrivateKey`of the given`algorithm`to the device once imported or generated. This can be used to tell if there is special hardware support that can be used to bind keys to the device in a way that makes it non-exportable.
| Parameters || |-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `algorithm` | `String`: This value cannot be`null`. Value is[KeyProperties.KEY_ALGORITHM_RSA](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_RSA),[KeyProperties.KEY_ALGORITHM_EC](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_EC), android.security.keystore.KeyProperties.KEY_ALGORITHM_XDH,[KeyProperties.KEY_ALGORITHM_AES](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_AES),[KeyProperties.KEY_ALGORITHM_HMAC_SHA1](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA1),[KeyProperties.KEY_ALGORITHM_HMAC_SHA224](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA224),[KeyProperties.KEY_ALGORITHM_HMAC_SHA256](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA256),[KeyProperties.KEY_ALGORITHM_HMAC_SHA384](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA384), or[KeyProperties.KEY_ALGORITHM_HMAC_SHA512](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA512)
| | Returns || |-----------|--------| | `boolean` |
| ### isCredentialManagementApp Added in[API level 31](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static boolean isCredentialManagementApp (Context context) ``` Check whether the caller is the credential management app`CredentialManagementApp`. The credential management app has the ability to manage the user's KeyChain credentials on unmanaged devices. [KeyChain.createManageCredentialsIntent](https://developer.android.com/reference/android/security/KeyChain#createManageCredentialsIntent(android.security.AppUriAuthenticationPolicy))should be used by an app to request to become the credential management app. The user must approve this request before the app can manage the user's credentials. There can only be one credential management on the device. This method may take several seconds to complete, so it should only be called from a worker thread.
| Parameters || |-----------|-----------------------------------------------| | `context` | `Context`: This value cannot be`null`.
| | Returns || |-----------|--------------------------------------------------------------| | `boolean` | `true`if the caller is the credential management app.
| ### isKeyAlgorithmSupported Added in[API level 18](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static boolean isKeyAlgorithmSupported (String algorithm) ``` Returns`true`if the current device's`KeyChain`supports a specific`PrivateKey`type indicated by`algorithm`(e.g., "RSA").
| Parameters || |-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `algorithm` | `String`: This value cannot be`null`. Value is[KeyProperties.KEY_ALGORITHM_RSA](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_RSA),[KeyProperties.KEY_ALGORITHM_EC](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_EC), android.security.keystore.KeyProperties.KEY_ALGORITHM_XDH,[KeyProperties.KEY_ALGORITHM_AES](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_AES),[KeyProperties.KEY_ALGORITHM_HMAC_SHA1](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA1),[KeyProperties.KEY_ALGORITHM_HMAC_SHA224](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA224),[KeyProperties.KEY_ALGORITHM_HMAC_SHA256](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA256),[KeyProperties.KEY_ALGORITHM_HMAC_SHA384](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA384), or[KeyProperties.KEY_ALGORITHM_HMAC_SHA512](https://developer.android.com/reference/android/security/keystore/KeyProperties#KEY_ALGORITHM_HMAC_SHA512)
| | Returns || |-----------|--------| | `boolean` |
| ### removeCredentialManagementApp Added in[API level 31](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) ``` public static boolean removeCredentialManagementApp (Context context) ``` Called by the credential management app`CredentialManagementApp`to unregister as the credential management app and stop managing the user's credentials. All credentials previously installed by the credential management app will be removed from the user's device. An app holding`MANAGE_CREDENTIAL_MANAGEMENT_APP`permission can also call this method to remove the current credential management app, even if it's not the current credential management app itself. This method may take several seconds to complete, so it should only be called from a worker thread.
| Parameters || |-----------|-----------------------------------------------| | `context` | `Context`: This value cannot be`null`.
| | Returns || |-----------|-------------------------------------------------------------------------| | `boolean` | `true`if the credential management app was successfully removed.
|